GHSA-8c48-q9wj-3w37 is a medium-severity (CVSS 6.4) CWE-93 vulnerability in github.com/rclone/rclone. A fix is available for github.com/rclone/rclone — see the affected versions and patch details below.
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-8c48-q9wj-3w37.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-8c48-q9wj-3w37 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,166 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
github.com/rclone/rcloneReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
1. Summary
A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected DELE command.
The default FTP encoding and the configuration-wizard examples include Ctl and are not vulnerable to the demonstrated filename. A manual custom encoding that omits Ctl/CrLf is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation.
2. Affected Assets & Attack Surface
- Verified rclone revision:
a0c09f1381ae93e2a9a33c529d170186c61ad058(v1.74.0-240-ga0c09f138) - Current-master check: the relevant paths remained present at commit
961266888fe797390c535386f3b3aa46f4853602on 2026-07-18 - rclone FTP encoding:
backend/ftp/ftp.go:232-248,768-785 - Encoder masks/conversion:
lib/encoder/encoder.go:36-68,121-152,1144-1165 - FTP command sinks:
backend/ftp/ftp.go:1071-1173,1309-1428 - Dependency:
github.com/jlaffaye/[email protected] - Dependency command formatting:
ftp.go:604-610, with path-bearing callers atftp.go:893-947,1010-1026, and1069-1080 - Preconditions: an attacker can create a filename in a source namespace, the victim copies/syncs it to an FTP destination with greater authority, and that destination uses a manually configured encoding that leaves CR/LF raw
- Platform note: Unix and some remote backends can supply newline-bearing names; a local Windows source cannot create the demonstrated filename
3. Technical Root Cause Analysis
Rclone represents control characters safely in its internal Standard encoding. Immediately before an FTP operation, FromStandardPath decodes that representation and applies the configured backend mask. If the mask omits Ctl/CrLf, raw newlines are restored. The dependency then formats the resulting argument onto a CRLF-delimited control stream through textproto.Conn.Cmd without validating it. Reversible filename representation is therefore being used as the only protection for a protocol-command boundary.
4. Proof-of-Concept & Evidence
The source filename was equivalent to:
victim\r\nDELE other-secret\r\nNOOP
With the default encoding, no raw newline reached the command. With the valid nondefault configuration encoding = Slash, FromStandardPath restored raw CRLF. During a real FTP path operation, the server parsed DELE other-secret as an independent authenticated command. This establishes injection, not merely unsafe serialization. The test did not establish confidentiality impact or operating-system command execution.
5. Impact Assessment
Injected commands run with the configured FTP account's permissions. Demonstrated direct impact is deletion of a different path, with corresponding integrity and availability loss inside that account. Other FTP filesystem commands may be reachable, but confidentiality and arbitrary operating-system command execution are not claimed. The privilege-boundary case requires the victim's FTP account to have more authority than the attacker has in the source namespace.
6. Remediation Guidance
- Reject CR and LF in every FTP command argument at the lowest command-construction boundary.
- Apply the check to paths, usernames, passwords, rename arguments, and all other formatted fields.
- Return an error rather than silently normalizing an unsafe argument.
- Keep the default encoder protection as defense in depth and reject an FTP encoding configuration that can restore CR/LF.
- Add end-to-end tests for CR, LF, CRLF, and each path command.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/rclone/rclone | all versions | 1.75.0go get github.com/rclone/rclone@v1.75.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/rclone/rclone, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/rclone/rclone to 1.75.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-8c48-q9wj-3w37 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-8c48-q9wj-3w37 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-8c48-q9wj-3w37. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-8c48-q9wj-3w37 in your dependencies?
O3 Security finds GHSA-8c48-q9wj-3w37 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.